GOOGLE’S September 2026 Android security updates patch a total of 180 vulnerabilities across multiple components, with the rollout split into two patch levels. The first part, 2026-09-01, addresses 95 defects across Android runtime, Framework, System, Setup Wizard and several Project Mainline modules delivered via Google Play system updates.
The second part, 2026-09-05, fixes 85 defects affecting the kernel and related components, including elements for TV and a range of chip vendors (Arm, Imagination Technologies, MediaTek, Qualcomm, Unisoc, Tsinghua Micro, and others). The announcement emphasises that the System component carries the heaviest burden, including 56 fixes and 23 critical-severity flaws capable of remote code execution (RCE), privilege escalation and DoS, with exploitation not requiring user interaction.
A notable public concern highlighted by the advisory is CVE-2026-28662, a Wi-Fi related memory corruption flaw that could enable remote code execution with no further privileges or user interaction. Security researchers and organisations are urged to apply the patches promptly across fleets, particularly because many critical fixes reside in the System component responsible for core functionality.
The bulletin also notes that Wear OS, Android XR and Android Automotive OS receive fixes aligned with the September 2026 Android bulletin, but there were no separate patches issued for those platforms in this cycle. Devices updated to patch level 2026-09-05 or newer will have fixes for all vulnerabilities addressed by the September bulletin.